Privacy Policy
Last updated: 25 January 2026
Who is the data controller
The controller of personal data (the “Controller”) is:
Estrela de Montesinho
Estrela de Montesinho - Alojamentos e Turismo, Lda | NIF: 515732303
Address: Lugar do Reconco, EN 103-7, n.º4477, 5300-673 Meixedo, Bragança
Contact: estrela.montesinho@gmail.com | +351 968 333 605 / +351 918 776 950
What data we collect
Depending on how you use the website and our services, we may process:
- Contact details (e.g., name, email, phone) when you contact us or request information;
- Booking data (e.g., dates, number of guests, special requests) when you request/make reservations;
- Billing data (e.g., tax number, billing address) where applicable;
- Technical data (e.g., IP address, browser and device information) for website security and operation;
- Preferences (e.g., language), via technical cookies.
Purposes and legal bases
| Purpose | Examples | Legal basis |
|---|---|---|
| Managing contacts and requests | Replying to messages sent by email/phone or forms. | Pre-contractual steps and/or legitimate interests. |
| Managing bookings and stays | Confirming bookings, communicating check-in/out details, handling special requests. | Performance of a contract and pre-contractual steps. |
| Compliance with legal obligations | Invoicing, tax/accounting requirements, and obligations applicable to accommodation services. | Legal obligation. |
| Security and fraud prevention | Technical records, security logs, incident management. | Legitimate interests. |
| Communications and marketing (if applicable) | Sending updates and campaigns (with an opt-out option). | Consent and/or legitimate interests (as applicable). |
Where consent is required (e.g., non-essential cookies), it can be withdrawn at any time without affecting the lawfulness of processing carried out based on consent previously given.
Who we share data with
We may share personal data with:
- Service providers (e.g., web hosting, technical support, email tools), to the extent necessary;
- Payment entities and/or booking platforms, where applicable;
- Public authorities, where required by law.
All providers are selected based on security criteria and, where applicable, are subject to contractual confidentiality obligations.
International transfers
As a rule, we aim to process data within the European Economic Area (EEA). If a transfer outside the EEA occurs (for example, when using a provider with servers outside the EEA), we will ensure appropriate safeguards (e.g., Standard Contractual Clauses) in accordance with applicable law.
Data retention
We retain data only for as long as necessary for the purposes described or for legally mandated periods. Examples: invoicing data may need to be retained for legal periods; contact data may be deleted after the request is resolved, unless it is necessary to keep records for legitimate purposes (e.g., defence of legal claims).
Data subject rights
Under applicable rules, you may exercise the following rights:
- Access to your data;
- Rectification;
- Erasure (“right to be forgotten”), where applicable;
- Restriction of processing;
- Objection to processing (including marketing);
- Portability (where applicable);
- Withdraw consent (where processing is based on consent).
To exercise your rights, contact us at estrela.montesinho@gmail.com.
Security
We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, destruction, or improper disclosure. However, no system is 100% secure, so we ask that you also protect your devices and credentials.
Complaints
If you believe the processing of your data violates applicable law, you may lodge a complaint with the competent supervisory authority in Portugal (CNPD). We recommend contacting us first so we can try to resolve the matter.
Changes to this policy
We may update this Privacy Policy periodically. Whenever there are material changes, we will update the revision date and, where appropriate, provide additional information on the website.